always use https when linking to assets